#
# Provision an SSL keypair using what's already generated in:
# /etc/ssl/private/ssl-cert-snakeoil.key (private key) and
# /etc/ssl/certs/ssl-cert-snakeoil.pem (public cert).
#
# The result will be /etc/<service_name>/ssl/<private|public>/<FQDN>.<key|crt>
# 
class oci::sslkeypair(
  $service_name = undef,
){

    file { "/etc/${service_name}/ssl":
      ensure                  => directory,
      owner                   => 'root',
      mode                    => '0755',
      selinux_ignore_defaults => true,
    }->
    file { "/etc/${service_name}/ssl/private":
      ensure                  => directory,
      owner                   => 'root',
      mode                    => '0755',
      selinux_ignore_defaults => true,
    }->
    file { "/etc/${service_name}/ssl/public":
      ensure                  => directory,
      owner                   => 'root',
      mode                    => '0755',
      selinux_ignore_defaults => true,
    }->
    file { "/etc/${service_name}/ssl/private/${::fqdn}.key":
      ensure                  => present,
      owner                   => "${service_name}",
      source                  => "/etc/ssl/private/ssl-cert-snakeoil.key",
      selinux_ignore_defaults => true,
      mode                    => '0600',
    }->
    file { "/etc/${service_name}/ssl/public/${::fqdn}.crt":
      ensure                  => present,
      owner                   => "${service_name}",
      source                  => '/etc/ssl/certs/ssl-cert-snakeoil.pem',
      selinux_ignore_defaults => true,
      mode                    => '0644',
    }
}
